CVE-2025-1306: 
WordPress vulnerability analysis and mitigation

The Newscrunch theme for WordPress contains a Cross-Site Request Forgery (CSRF) vulnerability affecting all versions up to and including 1.8.4. The vulnerability was discovered by Gibran Abdillah and was disclosed on March 3, 2025 (NVD, Wordfence).

The vulnerability stems from missing or incorrect nonce validation in the newscrunch_install_and_activate_plugin() function. This security flaw has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a severe security risk (NVD).

The vulnerability allows unauthenticated attackers to upload arbitrary files through forged requests if they can trick a site administrator into performing specific actions, such as clicking on a malicious link. This could potentially lead to remote code execution on affected WordPress installations (NVD).

The vulnerability requires user interaction (such as an administrator clicking on a malicious link) to be exploited. The attack complexity is considered low, requiring no special access privileges for exploitation (NVD).

Website administrators running the Newscrunch WordPress theme should upgrade to version 1.8.4.1 or later, which contains the security fix for this vulnerability (NVD).